Free DNS Security Check
Evaluate DNSSEC, CAA records, wildcard configuration and common DNS risks.
Strengthen domain protections and reduce spoofing risks.
- DNSSEC & CAA
- Wildcard review
- Cache poisoning risks
"Barrion's security scanning has helped us implement best security practices efficiently, saving us countless hours."
Sarah Chen
Head of Security
"We identified and fixed critical vulnerabilities before our platform launch, saving us from potential data breaches."
Marcus Anderson
CTO
"Barrion gives us peace of mind, knowing we're notified of any security issues. Exactly what our team needed."
Oskar Nilsson
Tech Lead
Scan in three simple steps
Fast, safe, non-intrusive checks with actionable results.
Start scan
Enter your URL, and click the start scan button to begin.
Scan runs
Barrion performs passive, read-only security checks with minimal site impact.
Take Action
Fix issues with step-by-step guidance and enable monitoring for continuous protection.
What this checker validates
- DNSSEC detection (DNSKEY, RRSIG, NSEC, NSEC3, DS records)
- DS (Delegation Signer) record presence in parent domain
- Basic chain of trust validation for DNSSEC records
- CAA record presence detection
- Wildcard DNS record detection and exposure analysis
- DNS amplification vulnerability assessment (ANY query responses)
- Cache poisoning vulnerability testing (predictable transaction IDs)
- DNS rebinding vulnerability detection (short TTL values)
- Comprehensive subdomain takeover vulnerability detection
- TTL (Time To Live) minimum value analysis
- Subdomain takeover vulnerability detection
Why DNS Security Matters
- Prevents DNS hijacking and cache poisoning attacks
- Protects against subdomain takeover vulnerabilities
- Reduces risk of certificate mis-issuance
- Mitigates DNS-based DDoS amplification attacks
- Ensures DNS responses haven't been tampered with
- Validates authenticity of DNS records
- Provides cryptographic proof of DNS data integrity
- Protects against man-in-the-middle DNS attacks
- Meets security compliance requirements
- Enhances user trust and confidence
- Demonstrates security best practices
- Reduces liability from security incidents
How to improve DNS security
- Enable DNSSEC at your domain registrar or DNS provider
- Generate and configure DNSKEY records
- Publish DS records with your registrar
- Monitor DNSSEC chain of trust regularly
- Add CAA records to control certificate issuance
- Specify authorized Certificate Authorities
- Configure wildcard certificate policies
- Set up violation reporting (iodef)
- Remove unnecessary wildcard DNS records
- Implement proper TTL values to prevent DNS rebinding
- Secure subdomains to prevent takeover attacks
- Monitor DNS changes and anomalies
Tool-specific questions
What is DNSSEC and why is it important?
How do I enable DNSSEC for my domain?
What are CAA records and how do they improve security?
What's the difference between DNS and DNSSEC?
Can DNSSEC impact website performance?
What are wildcard DNS records and why are they risky?
How often should I review my DNS security configuration?
What's DNS cache poisoning and how does DNSSEC prevent it?
What is subdomain takeover and how does your checker detect it?
Why Choose Barrion?
Real-Time Results
Instant security analysis with detailed reports, giving you an immediate security overview
Comprehensive Checks
Multiple best-practice security checks in a single scan, for broad coverage
Actionable and Effective
Clear recommendations for fixes, helping you improve your security quickly and effectively
Other Tools
Complete Security Scan
Complete website security analysis with comprehensive vulnerability detection
- Full security assessment
- Detailed security report
- Actionable recommendations
- Risk severity scoring
Security Headers Test
Check your website's HTTP security headers configuration
- Content Security Policy
- X-Frame-Options
- X-Content-Type-Options
- Permissions Policy
- Referrer Policy
- And more...
TLS/SSL Security Checker
Validate your SSL/TLS configuration and certificate setup
- HTTPS verification
- HSTS check
- TLS version check
- Cipher suite analysis
- Mixed content detection
Content Security Policy (CSP) Checker
Analyze your CSP for unsafe directives and strengthen your policy with best practices.
- CSP directives analysis
- Detect unsafe-inline/eval
- Nonce/Hash guidance
CORS Policy Checker
Validate Access-Control headers, credentials safety, and simulate preflight requests.
- ACAO configuration
- Preflight simulation
- Credentials safety
Cookie Security Checker
Audit HttpOnly, Secure, SameSite and Partitioned cookie attributes for safety.
- HttpOnly & Secure flags
- SameSite settings
- Partitioned cookies
